In March 2024, a token called “BASED” launched on Base — Coinbase’s Layer 2 network. Within 48 hours it reached a $4 million market cap, driven by a slick website, a verified X account, and a community of buyers who assumed that anything on “Coinbase’s chain” must be safe. The token had an ERC-20 contract, a Uniswap liquidity pool, and even a locked-liquidity badge. Then the developers called a hidden setFees() function that applied a 100% tax on every sell transaction. Buyers could purchase tokens, but they could never sell them. The pool drained as the team withdrew through a backdoor mechanism. Every investor was left holding worthless tokens they could not exit.
This is not an Ethereum-specific problem. It is not a BNB Chain problem. It is a Base problem — and Base has unique characteristics that make these scams both more common and harder to detect if you don’t know what to look for.
Base processed over $15 billion in decentralized exchange volume in a single month in early 2025. That kind of liquidity attracts legitimate projects. It also attracts every type of scammer who knows that users associate the Coinbase brand with safety. They exploit that trust. This guide covers the specific risks of buying tokens on Base, the tools that work on this chain, and the exact verification steps you should run before sending a single wei to a Base token contract.
BLUF: Base is an EVM-compatible Layer 2, which means the same smart contract scams (honeypots, rug pulls, hidden mint functions, fake liquidity locks) that exist on Ethereum mainnet also exist on Base — but lower gas costs make them cheaper to deploy and easier to spin up at scale. Before buying any Base token, check six things: (1) Is the contract verified on Basescan? (2) Is liquidity locked in a real timelock? (3) Is there a mint function that lets developers create unlimited tokens? (4) Are buy/sell tax functions hidden in the code? (5) Who holds the token supply — is it concentrated in a few wallets? (6) Does GoPlus Security flag it as high-risk? Use Token Sniffer, GoPlus, and Basescan together — never rely on a single tool.
Why Base Has Unique Risk Characteristics
Base is an Optimistic Rollup built by Coinbase on the OP Stack. It inherits the full EVM instruction set, meaning any smart contract that runs on Ethereum can be deployed on Base with minimal modification. This is great for developers. It is also great for scammers, because:
Low deployment cost. Deploying a token contract on Ethereum mainnet costs $50–500 in gas depending on complexity. On Base, the same deployment costs under $1. A scammer can deploy dozens of token contracts per day, test which one gets traction, and abandon the rest. The low cost also means they can create elaborate multi-contract scams — fake lock contracts, fake staking contracts, fake airdrop claim contracts — without breaking the bank.
Fast block times. Base produces blocks every 2 seconds, compared to Ethereum’s ~12 seconds. This means rug pulls execute faster. A developer can drain a liquidity pool and bridge the funds to another chain before most victims even see the transaction in their wallet. The window between “something is wrong” and “the money is gone” is measured in seconds, not minutes.
Brand association. Many users, especially newer ones, assume that Base tokens are somehow vetted by Coinbase. They are not. Coinbase operates the sequencer and the bridge, but it does not audit or approve tokens deployed on Base. Anyone can deploy anything. The Coinbase brand creates a false sense of security that scammers actively exploit in their marketing — naming tokens “Coinbase-backed” or “CB-verified” when no such backing exists.
Cross-chain bridging complexity. Base connects to Ethereum and other chains through the official Base bridge and third-party bridges. Scammers use bridges to move stolen funds across chains, making recovery harder. The bridging process also introduces its own attack surface — fake bridge contracts, phishing sites that mimic the official bridge, and tokens that appear identical on different chains but have different contract addresses.
Step-by-Step: How to Verify a Base Token
Step 1: Find and Verify the Contract on Basescan
Basescan (basescan.org) is the primary block explorer for Base, operated by Etherscan. Every legitimate token has a verifiable contract address.
- Copy the token’s contract address from the DEX (Aerodrome, Uniswap Base, Baso Swap) where you found it
- Paste it into the Basescan search bar
- Check that the contract is verified — look for a green checkmark next to the “Contract” tab
An unverified contract is an immediate red flag. Legitimate projects verify their source code because it builds trust. Scammers often leave contracts unverified to hide malicious functions. If the contract is unverified, do not buy the token. No exceptions.
| Contract Status | What It Means | Action |
|---|---|---|
| Verified, clean audit | Source code is public and reviewed | Proceed to next checks |
| Verified, no audit | Source is public but not professionally reviewed | Review the code yourself or skip |
| Verified, suspicious functions | Source is public but contains red flags | Do not buy |
| Unverified | Source code is hidden | Do not buy |
Step 2: Check for Hidden Mint Functions
A mint function allows the contract owner to create new tokens out of thin air. On Base, this is particularly dangerous because gas is cheap — a scammer can mint millions of tokens and dump them into the liquidity pool for fractions of a cent.
On Basescan, go to the “Contract” tab and search the source code for:
// Red flag functions to search for:
function mint(
function _mint(
function mintTo(
function batchMint(If any of these functions exist and are callable by the owner (check for onlyOwner or similar access control modifiers), the token supply is mutable. The developers can inflate the supply at will, diluting your holdings to zero.
Some scammers obfuscate minting behind proxy contracts or upgradeable patterns. Check if the contract uses a proxy pattern — if it does, the implementation can be changed after deployment, meaning the current “clean” code could be swapped for malicious code later. Look for delegatecall in the contract, which is the hallmark of proxy/upgradeable contracts.
Step 3: Check Buy and Sell Tax Functions
Hidden transaction taxes are one of the most common scams on Base. The contract appears normal, but internal logic applies a tax (sometimes 50%, sometimes 99%, sometimes 100%) on sell transactions. You can buy freely, but when you try to sell, the tax eats your entire investment.
Search the verified source code for:
// Tax-related patterns to look for:
function _update( // ERC-20 transfer override
function _transfer(
function setFee(
function setTax(
function setSwapTokensAtAmount(
function excludeFromFees(A legitimate token either has no tax or has a clearly documented, capped tax (e.g., “1% treasury fee”). If the tax rate is variable (can be changed by the owner) or if the sell tax differs from the buy tax, you are looking at a potential trap.
Step 4: Verify Liquidity Is Locked
Liquidity locking on Base works identically to Ethereum — LP tokens are placed in a timelock contract. The same verification steps apply. Check our detailed guide on how to check if liquidity is locked for the full process.
The Base-specific wrinkle: because gas is cheap, scammers can create fake lock contracts that cost almost nothing to deploy. Do not trust a “Locked” badge on a DEX without verifying the lock contract on Basescan yourself. Look for:
- LP tokens held in a recognized lock platform contract (Unicrypt, PinkLock, Team Finance)
- Lock duration of at least 3–6 months
- 95–100% of LP tokens locked (not partial locks)
- Lock contract source code is verified with no admin override functions
Step 5: Analyze Token Holder Distribution
Go to the token’s “Holders” tab on Basescan. The distribution pattern tells you a lot about whether the token is a genuine community project or a controlled scheme.
| Pattern | Risk | Why |
|---|---|---|
| Top 10 holders < 20% | Low | Broad distribution, no single party controls price |
| Top 10 holders 20–40% | Moderate | Some concentration, common for early-stage projects |
| Top 10 holders > 50% | High | A few wallets control the majority of supply |
| One wallet > 20% | Critical | A single holder can crash the price by selling |
| Team wallets unlabeled | High | Large holdings in unnamed wallets could dump anytime |
Also check whether the deployer wallet holds a significant percentage. If the deployer still controls 30%+ of the supply, they can dump at any time — even with locked liquidity, because the lock only protects the pool, not the token supply.
Step 6: Run a GoPlus Security Check
GoPlus Security provides real-time token risk data across multiple chains including Base. It checks for over 30 risk indicators automatically. You can query GoPlus data through our free token risk check tool by entering any Base contract address.
GoPlus checks for:
- Hidden mint functions
- Hidden honeypot conditions (can buy but cannot sell)
- Buy/sell tax rates (actual, not claimed)
- Whether the contract is a proxy
- Whether the token is marked as a scam by community sources
- LP lock status and lock holder analysis
- Whether the token contract matches known scam signatures
A GoPlus “is_honeypot: 1” result is a hard stop. Do not buy that token under any circumstances. Even a “1” on any single risk factor warrants further investigation — but honeypot status is definitive.
Common Base-Specific Scams
Fake Coinbase Airdrops
Scammers create tokens named after Coinbase products (Base, cbBTC, cbETH, Smart Wallet) and distribute them through airdrop claim websites. The claim process requires you to connect your wallet and sign a transaction — but the transaction is a token approval or a permit signature that grants the scammer access to your wallet. Always verify airdrops through official Coinbase channels. If an airdrop requires connecting to an unfamiliar website, it is a scam.
Bridged Token Impersonation
Because Base is an L2, many tokens exist on both Ethereum and Base. Scammers create tokens on Base with the same name and ticker as legitimate Ethereum tokens, then list them on DEXes. Users who don’t verify the contract address end up buying worthless copies. Always cross-reference the token’s Base address with the project’s official documentation or the Ethereum mainnet contract.
Aerodrome Pool Spoofing
Aerodrome is the largest DEX on Base. Scammers create fake liquidity pools on Aerodrome with misleading token pairings — for example, pairing their scam token with a small amount of USDC to create the illusion of a deep, legitimate market. The pool looks real on the DEX interface, but the actual token contract is malicious. Always verify the token contract independently, not just the pool.
Smart Wallet Phishing
Coinbase’s Smart Wallet (account abstraction) makes onboarding easier, but it also creates a new phishing surface. Scammers create fake “Smart Wallet” connection pages that mimic the official Coinbase UI. When users connect, they unknowingly grant spending permissions to the scammer’s contract. For a deeper understanding of wallet drainer attacks, see our guide on how to spot wallet drainers.
Tools for Base Token Verification
| Tool | What It Checks | Cost | Base Support |
|---|---|---|---|
| Basescan | Contract source, holders, transactions | Free | Native |
| GoPlus Security API | 30+ risk factors, honeypot detection, tax analysis | Free | Full |
| Token Sniffer | Automated contract scoring, liquidity lock check | Free | Ethereum + Base |
| DexScreener | Real-time DEX data, liquidity, volume, holders | Free | Base supported |
| DEXTools | Pool analytics, lock verification, token pair explorer | Free / Paid | Base supported |
| GoPlus via our tool | Integrated GoPlus query with risk summary | Free | Full |
Recommended workflow: Start with DexScreener to get the contract address and basic pool data. Then check Token Sniffer for an automated risk score. Then verify the contract on Basescan manually. Finally, run GoPlus through our token safety tool for the definitive honeypot and tax check. If all four sources agree the token is clean, your risk is substantially reduced — though never zero.
Base vs. Ethereum vs. BNB Chain: Risk Comparison
| Risk Factor | Ethereum Mainnet | Base L2 | BNB Chain |
|---|---|---|---|
| Deployment cost for scammers | High ($50–500) | Very Low (<$1) | Low ($5–20) |
| Block time (rug pull speed) | ~12s | ~2s | ~3s |
| Token verification tools | Extensive | Growing | Extensive |
| Brand trust exploitation | Low | High (Coinbase) | Moderate (Binance) |
| Liquidity lock ecosystem | Mature | Growing | Mature |
| MEV / sandwich attack risk | High | Moderate | Moderate |
| Recovery of stolen funds | Difficult | Very difficult (cross-chain bridge) | Difficult |
The key takeaway from this table: Base combines the scam techniques of Ethereum (full EVM compatibility) with the speed and low cost of alt-L1s, while adding a unique brand-trust vulnerability. The verification process is the same, but the speed at which scams execute means you need to do your research before the token is trending, not after.
Limitations: What Verification Cannot Catch
Even after running all six checks, some risks remain:
Social engineering. No on-chain tool can detect whether a project’s team is real, whether their roadmap is genuine, or whether their community is organic. A perfectly clean contract can still be a pump-and-dump where the team slowly sells their allocation into retail buying pressure.
Upgradeable contracts. A proxy contract may pass all checks today but be upgraded to a malicious implementation tomorrow. If the contract uses a transparent proxy or UUPS pattern, the current code is only a snapshot — the owner can change the logic at any time.
Novel attack vectors. Tools like GoPlus rely on known scam signatures. Zero-day exploit techniques — new ways to hide honeypot logic, new obfuscation patterns — will not be detected until the tools are updated. This is why diversification matters even after thorough verification.
Bridging risk. If you bridge assets to Base from Ethereum, the bridge itself is an attack surface. Bridge exploits have resulted in some of the largest losses in crypto history. Always use the official Base bridge or well-established third-party bridges, and never click bridge links from social media.
For a broader understanding of on-chain risk analysis methodology, see our guide on the on-chain analysis workflow.
Frequently Asked Questions
Q: Is Base safer than Ethereum for buying tokens?
A: Base uses the same smart contract technology as Ethereum, so the same types of scams exist on both. Base’s lower gas costs make scams cheaper to deploy, and its association with Coinbase can create false confidence. The verification process is identical — always check the contract, liquidity, and holder distribution regardless of which chain you are on.
Q: Can I use Etherscan to check Base tokens?
A: No. Etherscan is for Ethereum mainnet. Base has its own explorer at basescan.org, operated by the same company. The interface and features are nearly identical, but the data is chain-specific. Always use Basescan for Base contract addresses.
Q: What is the safest way to buy tokens on Base?
A: Only buy tokens from projects you have thoroughly researched. Verify the contract on Basescan, check liquidity lock status, run a GoPlus scan, review the holder distribution, and confirm there are no hidden mint or tax functions. Start with a small test transaction before making a larger purchase.
Q: Are tokens on Coinbase Wallet vetted?
A: No. Coinbase Wallet is a self-custody wallet that allows you to interact with any contract on any supported chain. Coinbase does not vet or guarantee tokens that appear in your wallet. Tokens may show up in your wallet as airdrops from scammers hoping you will interact with them — never click on or interact with unsolicited tokens.
Q: What should I do if I bought a scam token on Base?
A: If you can still sell (the tax is not 100%), sell immediately for whatever you can recover. If you cannot sell, the token is a honeypot and your funds are lost. Do not attempt to interact further with the contract — some malicious contracts drain additional funds through fake “claim refund” or “unstake” functions. For tracking stolen funds, see our guide on how to track stolen crypto.
Key Takeaways
- Base is fully EVM-compatible — the same smart contract scams that exist on Ethereum exist on Base, but low gas costs make them cheaper and faster to execute.
- Always verify the contract on Basescan — an unverified contract is a hard stop. Search for mint functions, tax functions, and proxy patterns.
- Check liquidity independently — Base’s low gas makes fake lock contracts trivial to deploy. Verify the lock on Basescan, not on the project’s website.
- Run GoPlus for every token — a honeypot flag from GoPlus is definitive. Use our free token safety tool to check any Base contract.
- The Coinbase brand does not protect you — Coinbase operates the Base network but does not audit tokens. Anyone can deploy anything.
- Bridging adds risk — always use official bridges, and be aware that bridged funds are harder to recover if stolen.
- Speed matters — Base’s 2-second block times mean rug pulls execute in seconds. Do your research before a token is trending, not after.
For more on protecting yourself from token scams across all chains, see our guides on how to verify a token before buying, spotting rug pulls and honeypots, and DeFi protocol red flags.